Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

System, method and program product for detecting malicious software

a technology of malicious software and detection method, applied in the field of computer systems, can solve problems such as the inability to detect malicious software, the inability to disable a computer or conduct a denial of service attack on another computer, and the harmful nature of computer programs, so as to prevent damage

Inactive Publication Date: 2005-04-28
IBM CORP
View PDF10 Cites 38 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Benefits of technology

[0011] The invention resides in a system, method and program product for detecting malicious software within or attacking a computer system. In response to a system call, a hook routine is executed at a location of the system call to (a) determine a data flow or process requested by the call, (b) determine another data flow or process for data related to that of the call, (c) automatically generate a consolidated information flow diagram showing the data flow or process of the call and the other data flow or process. After steps (a-c), a routine is called to perform the data flow or process requested by the call. A user monitors the information flow diagram and compares the data flow or process of steps (a) and (b) with a data flow or process expected by said user. If there are differences, the user may investigate the matter or shut down the computer to prevent damage.

Problems solved by technology

They may attempt to delete, corrupt or steal important data, disable a computer or conduct a denial of service attack on another computer.
A computer virus is a computer program that is normally harmful in nature to a computer.
However, the firewall will block other types of messages.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • System, method and program product for detecting malicious software
  • System, method and program product for detecting malicious software
  • System, method and program product for detecting malicious software

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0024] The present invention provides a system, method and program product for monitoring and displaying the activity of a computer system in real time as an information flow diagram. This permits an operator to determine if the activity appears consistent with the bona fide work requested of the computer system. The information flow diagrams show the physical and virtual location of information entities at all stages of their processing and the operations, such as the copying, encryption and transmission of information. The information flow diagrams are generated in real time as the information is being processed and moved about the computer.

[0025]FIG. 1A shows an information flow diagram 100 for copying a file and renaming the copied file. A file 101 is saved at a first memory location 102. The file 101 is then copied from the first memory location 102 to a second memory location 103. At this time, the same file 101 concurrently resides at both the first and second memory locatio...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

System, method and program product for detecting malicious software within or attacking a computer system. In response to a system call, a hook routine is executed at a location of the system call to (a) determine a data flow or process requested by the call, (b) determine another data flow or process for data related to that of the call, (c) automatically generate a consolidated information flow diagram showing the data flow or process of the call and the other data flow or process. After steps (a-c), a routine is called to perform the data flow or process requested by the call. A user monitors the information flow diagram and compares the data flow or process of steps (a) and (b) with a data flow or process expected by said user. If there are differences, the user may investigate the matter or shut down the computer to prevent damage.

Description

BACKGROUND OF THE INVENTION [0001] This invention relates generally to computer systems, and deals more particularly with detection of malicious computer attacks such as caused by computer viruses, worms and hackers. [0002] Malicious computer attacks, such as manual “hacker” attacks, computer viruses and worms are common today. They may attempt to delete, corrupt or steal important data, disable a computer or conduct a denial of service attack on another computer. [0003] A manual attempt to “hack” a victim's server or workstation begins when a (hacker) person at a remote workstation attempts in real time to gain access to the victim's server or workstation. This typically begins by the hacker entering many combinations of user IDs and passwords, hoping that one such combination will gain access to sensitive software or data in the server or workstation. A hacker may also transmit an exploitation program which automatically exploits vulnerabilities in a victim's server, as would a ha...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(United States)
IPC IPC(8): G06F11/00G06F21/00
CPCG06F21/53G06F21/566G06F21/54
Inventor CHESS, DAVID M.LUKE, JAMES S.
Owner IBM CORP
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic, Popular Technical Reports.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap|About US| Contact US: help@patsnap.com